CDパイプライン設計：迅速かつ安全なリリースを実現するためのベストプラクティス

コード変更 → ビルド → テスト → 承認 → デプロイ
     ↑_________|_________|        ↑
         CI プロセス        |        |
                 |________|
                   継続的デリバリー
                 |______________|
                   継続的デプロイメント

# AWS CodeDeploy AppSpec.yml の例
version: 0.0
os: linux
files:
  - source: /
    destination: /var/www/html/
hooks:
  BeforeInstall:
    - location: scripts/before_install.sh
      timeout: 300
      runas: root
  AfterInstall:
    - location: scripts/after_install.sh
      timeout: 300
      runas: root
  ApplicationStart:
    - location: scripts/start_application.sh
      timeout: 300
      runas: root
  ValidateService:
    - location: scripts/validate_service.sh
      timeout: 300
      runas: root

# Kubernetes マニフェストの例
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-canary
spec:
  replicas: 1  # 本番の10%程度の規模
  selector:
    matchLabels:
      app: myapp
      track: canary
  template:
    metadata:
      labels:
        app: myapp
        track: canary
    spec:
      containers:
      - name: myapp
        image: myapp:v2
        ports:
        - containerPort: 8080
---
# サービスでトラフィックを分配
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp  # trackラベルを指定しないことで両方のDeploymentにトラフィックを分配
  ports:
  - port: 80
    targetPort: 8080

// LaunchDarkly等のフィーチャーフラグサービスを使用した例
import com.launchdarkly.sdk.LDUser;
import com.launchdarkly.sdk.server.LDClient;

public class MyService {
    private final LDClient ldClient;
    
    public MyService(LDClient ldClient) {
        this.ldClient = ldClient;
    }
    
    public void processRequest(String userId) {
        LDUser user = new LDUser.Builder(userId).build();
        
        if (ldClient.boolVariation("new-payment-process", user, false)) {
            // 新しい決済処理を実行
            processPaymentNewWay();
        } else {
            // 従来の決済処理を実行
            processPaymentOldWay();
        }
    }
}

# Nginxでのシャドウトラフィック設定例
server {
    listen 80;
    server_name dx-media.example;
    
    location / {
        # プライマリバックエンド
        proxy_pass http://production-backend;
        
        # シャドウトラフィックの設定
        mirror /mirror;
        mirror_request_body on;
    }
    
    # シャドウバックエンドへのルーティング
    location = /mirror {
        internal;
        proxy_pass http://new-version-backend$request_uri;
        proxy_pass_request_body on;
        proxy_set_header X-Shadow-Request "true";
    }
}

# ArgoCD Application マニフェスト例
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/myapp-config.git
    targetRevision: HEAD
    path: overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: myapp-prod
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

// Jenkinsfile
pipeline {
    agent {
        kubernetes {
            yaml """
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: maven
    image: maven:3.8.4-openjdk-11
    command:
    - cat
    tty: true
  - name: docker
    image: docker:20.10.12-dind
    command:
    - cat
    tty: true
    volumeMounts:
    - name: docker-socket
      mountPath: /var/run/docker.sock
  volumes:
  - name: docker-socket
    hostPath:
      path: /var/run/docker.sock
"""
        }
    }
    
    environment {
        DOCKER_REGISTRY = 'registry.dx-media.example'
    }
    
    stages {
        stage('ビルド') {
            steps {
                container('maven') {
                    sh 'mvn clean package'
                }
            }
        }
        
        stage('テスト') {
            steps {
                container('maven') {
                    sh 'mvn test'
                    junit '**/target/surefire-reports/TEST-*.xml'
                }
            }
        }
        
        stage('コンテナ作成') {
            steps {
                container('docker') {
                    sh 'docker build -t ${DOCKER_REGISTRY}/myapp:${BUILD_NUMBER} .'
                }
            }
        }
        
        stage('ステージング環境デプロイ') {
            steps {
                container('docker') {
                    sh 'docker push ${DOCKER_REGISTRY}/myapp:${BUILD_NUMBER}'
                    sh 'kubectl apply -f kubernetes/staging/'
                }
            }
        }
        
        stage('承認') {
            steps {
                input message: '本番環境へのデプロイを承認しますか？'
            }
        }
        
        stage('本番環境デプロイ') {
            steps {
                container('docker') {
                    sh 'kubectl apply -f kubernetes/production/'
                }
            }
        }
    }
    
    post {
        success {
            slackSend channel: '#deployments', color: 'good', message: "デプロイ成功: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
        }
        failure {
            slackSend channel: '#deployments', color: 'danger', message: "デプロイ失敗: ${env.JOB_NAME} #${env.BUILD_NUMBER}"
        }
    }
}

# main.tf
provider "aws" {
  region = "ap-northeast-1"
}

resource "aws_launch_configuration" "app_server" {
  name_prefix     = "app-server-"
  image_id        = "ami-0c3fd0f5d33134a76" # 最新のアプリケーションAMI
  instance_type   = "t3.medium"
  security_groups = [aws_security_group.app_server.id]
  
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "app_server" {
  name                 = "app-server-${aws_launch_configuration.app_server.name}"
  launch_configuration = aws_launch_configuration.app_server.name
  min_size             = 2
  max_size             = 10
  desired_capacity     = 4
  vpc_zone_identifier  = [aws_subnet.private_a.id, aws_subnet.private_c.id]
  
  lifecycle {
    create_before_destroy = true
  }
  
  tag {
    key                 = "Name"
    value               = "app-server"
    propagate_at_launch = true
  }
}

resource "aws_lb_target_group" "app_server" {
  name     = "app-server-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
  
  health_check {
    path                = "/health"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }
}

resource "aws_autoscaling_attachment" "app_server" {
  autoscaling_group_name = aws_autoscaling_group.app_server.name
  alb_target_group_arn   = aws_lb_target_group.app_server.arn
}

# docker-compose.yml
version: '3'
services:
  webapp:
    image: myapp:${APP_VERSION}
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - API_KEY=${API_KEY}
      - LOG_LEVEL=${LOG_LEVEL}

# ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  app.properties: |
    app.cache.size=1024
    app.thread.count=10
    app.feature.new-ui=false
---
# Secret
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  db-password: cGFzc3dvcmQxMjM=  # base64エンコードされたパスワード
  api-key: c2VjcmV0a2V5MTIz

// Flyway マイグレーション例（Java）
@Component
public class DatabaseMigrator {
    private final Flyway flyway;
    
    public DatabaseMigrator(DataSource dataSource) {
        this.flyway = Flyway.configure()
            .dataSource(dataSource)
            .locations("classpath:db/migration")
            .load();
    }
    
    @PostConstruct
    public void migrate() {
        flyway.migrate();
    }
}

-- V1__Create_users_table.sql
CREATE TABLE users (
    id BIGINT PRIMARY KEY,
    username VARCHAR(100) NOT NULL UNIQUE,
    email VARCHAR(255) NOT NULL,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);

-- V2__Add_user_status.sql
ALTER TABLE users ADD COLUMN status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE';

# Prometheus アラートルール
groups:
- name: app_alerts
  rules:
  - alert: HighErrorRate
    expr: sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) > 0.05
    for: 2m
    labels:
      severity: critical
    annotations:
      summary: "高エラー率検出"
      description: "直近5分間のHTTPエラー率が5%を超えています"

# インシデントポストモーテム

## 概要
- **日時**: YYYY-MM-DD HH:MM 〜 HH:MM
- **影響**: [影響を受けたシステム/ユーザー/機能]
- **重大度**: [Critical/High/Medium/Low]

## タイムライン
- HH:MM - デプロイ開始
- HH:MM - 異常検知
- HH:MM - 緩和策実施
- HH:MM - 解決

## 根本原因
[技術的および組織的要因を記述]

## 再発防止策
1. [短期的対策]
2. [中期的対策]
3. [長期的対策]

## 学び
[今回のインシデントから得られた重要な教訓]

# デプロイメトリクス収集スクリプト例
import datetime
import requests
import pandas as pd
from datetime import timedelta

# GitHubからコミット情報を取得
def get_commits(repo, since):
    url = f"https://api.github.com/repos/{repo}/commits"
    params = {"since": since.isoformat()}
    response = requests.get(url, params=params)
    return response.json()

# CIシステムからビルド情報を取得
def get_builds(project, since):
    url = f"https://jenkins.dx-media.example/job/{project}/api/json"
    params = {"tree": "builds[number,timestamp,result,duration]"}
    response = requests.get(url, params=params)
    builds = response.json()["builds"]
    return [b for b in builds if datetime.datetime.fromtimestamp(b["timestamp"]/1000) > since]

# デプロイ情報を取得
def get_deployments(app, since):
    url = f"https://deploy.dx-media.example/api/apps/{app}/deployments"
    params = {"since": since.isoformat()}
    response = requests.get(url, params=params)
    return response.json()

# 30日前から現在までのデータを取得
since = datetime.datetime.now() - timedelta(days=30)
commits = get_commits("myorg/myapp", since)
builds = get_builds("myapp", since)
deployments = get_deployments("myapp", since)

# リードタイム計算
# ...（省略）...

# メトリクスの保存と可視化
# ...（省略）...